These weren't personal data. They were business records. They didn't specify but it might be things like who was accessing what and when.
> For example, Moody’s Ratings Employees – including at the senior level – were communicating about credit ratings activities via text messages and WhatsApp on their personal devices, according to an SEC order. That included an associate managing director making off-channel comments about credit rating clients.
https://www.nytimes.com/2023/08/08/business/banks-fines-what...